Live › vulnerability › CVE-2026-116163
Go to dashboardParse Server custom authentication adapters that subclass AuthAdapter never run their validateSetUp, validateLogin, or validateUpdate methods, so an inherited default accepts any authData. An attacker can sign up, link identities, log in as existing users, or skip extra authentication factors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Applications running Parse Server with a custom authentication adapter that subclasses AuthAdapter are exposed, because the inherited default is what accepts the attacker's authData. Deployments using only built-in auth providers are not described as affected by the sources. Teams that run Parse Server as a backend should check their adapters.
No product ranges from the sources yet.
npm ls parse-server and confirm whether it is below 8.6.102 or in the 9.0.0 to 9.10.5-alpha.2 range.AuthAdapter and see whether they override validateSetUp, validateLogin, and validateUpdate.8.6.102 or later on the 8.x line, or to 9.10.5-alpha.2 or later on the 9.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.
This page as .md · .json · in your agent: get_signal("CVE-2026-116163")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.